From 62727f2e00c5c4ef00a89f23a00b5d0b151e809a Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Tue, 4 Feb 2014 17:58:17 +0000 Subject: [PATCH] tcptls.c: Made TLS handle a certificate chain file. Thanks to Guillaume Martres for doing the necessary research to validate the change. (closes issue ASTERISK-17727) Reported by: LN Patches: use_certificate_chain.patch (license #5864) patch uploaded by st documente_certificate_chain.patch (license #6576) patch uploaded by Guillaume Martres ........ Merged revisions 407272 from http://svn.asterisk.org/svn/asterisk/branches/1.8 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@407273 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- configs/sip.conf.sample | 6 ++++-- main/tcptls.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/configs/sip.conf.sample b/configs/sip.conf.sample index 4df7be9804..5042bab1be 100644 --- a/configs/sip.conf.sample +++ b/configs/sip.conf.sample @@ -526,8 +526,10 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls ; ;------------------------ TLS settings ------------------------------------------------------------ -;tlscertfile= ; Certificate file (*.pem format only) to use for TLS connections - ; default is to look for "asterisk.pem" in current directory +;tlscertfile= ; Certificate chain (*.pem format only) to use for TLS connections + ; The certificates must be sorted starting with the subject's certificate + ; and followed by intermediate CA certificates if applicable. + ; Default is to look for "asterisk.pem" in current directory ;tlsprivatekey= ; Private key file (*.pem format only) for TLS connections. ; If no tlsprivatekey is specified, tlscertfile is searched for diff --git a/main/tcptls.c b/main/tcptls.c index bfa3559859..e07f1f1a05 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -393,7 +393,7 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; - if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { + if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) { if (!client) { /* Clients don't need a certificate, but if its setup we can use it */ ast_verb(0, "SSL error loading cert file. <%s>\n", cfg->certfile); -- 2.47.2